FantasticSearch

Data management, protection of personal data and confidentiality

1. Personal data required for the application of Article 7(2), Article 13, Article 14(1), Article 15(1), Article 16(1), point (d), Article 17(3), (4) and (5), Article 20(2), Article 21(2) to (5), (7) and (8), Article 22(2) and (3), Article 23(11) and (12), Article 24, points (f) and (g), Article 27(1) and (2), Article 28(1) and (2), Article 30(3) and (4), Article 31(5), Articles 33 and 34, Article 35(1), Article 37(1), Article 38(1), Article 39, Article 40(1) and (3), Article 42(1), Article 43(1) and (2), Article 45(3), Article 47(1) and (3), Article 49(2) and (4), Article 50(2), points (c) and (d), and Article 52 shall be collected and processed by the authorities of the Member States, EFCA and the Commission for the following purposes:

(a) complying with the obligations of identifying relevant contact points and carrying out data exchanges of fisheries data in accordance with Articles 7, 8, 13 to 19, 21, 22, 27 to 31, 33, 34, 35, 37 to 40, 42 to 46, 49, 50 and 52;

(b) monitoring of fishing opportunities including quota uptake in accordance with Article 18;

(c) validation of data in accordance with Article 17;

(d) monitoring, control, inspection and surveillance of fishing activities in accordance with Articles 19 to 47; and (e) enquiries pertaining to complaints, infringements, and judicial or administrative proceedings, in accordance with Articles 35 to 40 and 42 to 47.

2. Personal data received in accordance with this Regulation shall not be stored for longer than is necessary for the purpose for which they were collected and, in any event, no longer than five years from the collection, except for personal data that is necessary to allow the follow-up of complaints, infringements and judicial or administrative proceedings, which may be retained until the end of the concerned procedure, administrative or judicial proceedings or the time needed for the application of sanctions. If the information is retained for a longer period, the data shall be anonymised.

3. The authorities of the Member States shall be regarded as controllers as defined in Article 4, point (7), of Regulation (EU) 2016/679 in relation to the processing of personal data which they collect and transmit pursuant to this Regulation.

4. The Commission and EFCA shall be each regarded as controllers as defined in Article 3, point (8), of Regulation (EU) 2018/1725 in relation to the processing of personal data which they collect and transmit pursuant to this Regulation.

5. In addition to the obligations set out in Regulations (EU) 2016/679 and (EU) 2018/1725, the authorities of the Member States, EFCA and the Commission shall each:

(a) ensure confidential treatment when transmitting and receiving electronic data;

(b) take the necessary measures to comply with the confidentiality and security provisions set out in Recommendations approved by NEAFC, including appropriate encryption protocols to ensure confidentiality and authenticity;

(c) where necessary, at the request of the NEAFC Secretariat, rectify or erase electronic reports or messages processed in a manner which does not comply with this Regulation;

(d) ensure that electronic data is stored and used only for monitoring, control, inspection and enforcement or other purposes specified in this Regulation; and (e) ensure that all transmission of electronic data use data communication systems duly tested with the NEAFC Secretariat.

6. The authorities of the Member States, EFCA and the Commission shall each ensure the security of the processing of personal data in respect of the processing of personal data that takes place for the application of this Regulation, including the processing of personal data by the authorities having a right to access relevant fisheries databases. In particular, they shall adopt the necessary measures, including a business continuity plan and measures to comply with the Guidelines and Terms and Conditions for the Information Security Management System adopted by NEAFC Recommendation 08:2014, in order to:

(a) physically protect data, including by making contingency plans for the protection of critical infrastructure;

(b) prevent the unauthorised reading, copying, modification or removal of data media;

(c) prevent the unauthorised input of data and the unauthorised access, modification or deletion of recorded personal data;

(d) prevent the unauthorised processing of data and any unauthorised copying, modification or deletion of data;

(e) ensure that persons authorised to access the relevant fisheries data bases have access only to the data covered by their access authorisation, by means of individual user identities and confidential access modes only;

(f) ensure that it is possible to verify and establish to which bodies personal data may be transmitted and what data has been processed in the relevant fisheries data bases, when, by whom and for what purpose;

(g) prevent the unauthorised reading, copying, modification or deletion of personal data during the transmission of personal data to or from the relevant fisheries data bases or during the transport of data media, in particular by means of appropriate encryption techniques; and (h) monitor the effectiveness of the security measures referred to in this paragraph and take the necessary organisational measures related to internal monitoring to ensure compliance with this Regulation.

7. The obligations laid down in Article 113 of Regulation (EC) No 1224/2009 shall apply to the data collected and received within the framework of this Regulation.